CN110115057A - Method and apparatus for capturing and/or promoting using grouping fault detection - Google Patents

Abstract

It describes for controlling by the various equipment in communication network, such as access point, the monitoring operation of execution and the method and apparatus for using the information obtained by the equipment for executing monitoring.These methods are highly suitable for having various access points, such as wireless and/or super joint, system, wherein access point can be used for obtaining the access to internet or another network.It is configured as the access point monitored according to the monitoring configuration information received, such as on the basis of each access point interface, grouping and monitored to detect communication failure corresponding with the communication equipment of described access point is used that capture grouping, storage capture.In response to detecting that communication failure, access point generate the event failure notification of the type for the failure that instruction detects and event failure notification are sent collectively to network monitoring node with the grouping of corresponding capture.

Description

Method and apparatus for capturing and/or using packets to facilitate fault detection

technical field

The present application relates to wireless communications and, more particularly, to methods and/or apparatus for capturing packets and/or other information that can be used to facilitate fault detection and/or correction in wireless communication networks.

Background technique

In the current wireless networking world, client complaints are often the trigger for setting up packet capture at the wireless access point. In this case, the customer has come to a point where they find it necessary or worthwhile to report the problem to the service provider.

Service providers can respond to complaints by setting up a special packet capture and debug module that controls the access point to capture all packets and subject them to one or more debug processes in an attempt to identify those associated with customer complaints problem at the particular access point. This approach results in the detection of recurring problems, but does not unequivocally account for the origin of the original complaint. This is because such post-complaint packet capture collects packets transmitted after the initial problem, rather than packets corresponding to the time of the initial problem or immediately before reporting the problem, which, if available, may be useful in determining the cause of a customer complaint, so that corrective action can be taken.

Therefore, while it may be useful to configure packet capture in response to complaints from particular users, the fact that customers must complain about service problems before taking action can lead to disgruntled customers. Additionally, configuring an access point to capture and report all packets for debugging can involve capturing and transmitting large amounts of data, even though most of the traffic may not be related to the reported problem.

While it is possible to detect the source of some problems by capturing and studying packets at a single access point, some problems may involve excessive handoffs between access points and/or different interfaces. From an interface point of view, there seems to be no communication problem and the user may be able to communicate successfully in a short period of time. However, due to repeated handovers or for other reasons that do not appear to individual access points as a communication failure, communication sessions may be dropped or suffer undesired interruptions, which may not be constraining to the user of a particular wireless terminal. satisfied. While certain devices may experience problems due to individual device settings, other devices may not experience such problems, and these problems may not manifest as communication failures to access points serving wireless terminals experiencing communication problems or question. This is especially true for devices that support multiple communication modes of operation, and can handover from an interface using one communication technology to an interface using another communication technology.

In view of the above discussion, it should be recognized that there is a need for a method and apparatus that allows for the detection of communication problems and the collection of information prior to individual customer complaints reporting, which would allow the source of failures to be determined and not just the source of future failures. There is also a need for methods and apparatus that allow for the detection and/or diagnosis of problems that may interfere with the quality of service provided to customers, but which may not be communication failures from the perspective of an individual communication interface or access point.

SUMMARY OF THE INVENTION

The present application is directed to methods and apparatus for controlling monitoring operations performed by various devices in a communication network (eg, wired or wireless devices) and for using information obtained by devices performing monitoring. These methods are well suited for systems with various access points (eg, wireless and/or wired access points) that can be used to gain access to the Internet or another network.

User Equipment (UE) devices (eg, cell phones, laptops, etc.) can connect to the Internet or another network through a wireless or wired access point using one or more network interfaces. For example, a UE device may connect to the Internet via a wireless interface such as a WiFi (802.11) interface, Long Term Evolution (LTE) interface, Bluetooth interface, or other wireless interface. Additionally or alternatively, the UE device may be connected to the Internet via a wired interface such as an Ethernet interface. In practice, UE devices can, and in some embodiments do, support connectivity through multiple interfaces and can switch between interfaces. Accordingly, UE devices may connect to and communicate with devices on the Internet in various ways, such as as part of a communication session or other communication.

Devices, especially multi-mode devices, may have conflicting settings and/or configuration issues that interfere with achieving Internet connectivity, especially when attempting to connect to a new access point (e.g., by UE devices moving through areas (e.g., coverage area corresponding to the wireless access point) detected wireless access point).

To achieve Internet connectivity, a UE device must often first establish a radio connection with an access point, successfully complete one or more authentication, authorization and/or accounting operations, successfully interact with a Dynamic Host Configuration Protocol (DHCP) server, and then successfully A Domain Name System (DNS) server is used before successfully establishing contact and/or obtaining information from a web server or other device on the Internet. Failures in any of the various steps required to achieve successful Internet access can interfere with the user's experience and ability to communicate or interact with devices on the Internet.

In accordance with various features of the invention, a network monitoring device (eg, a network monitoring node) may, and sometimes does, send configuration information, eg, instructions in the form of monitoring commands, which instruct the access point to monitor one or more The fault and the interface or interfaces on which to perform monitoring.

In at least some of these embodiments, the access point buffers packets received on an interface on which the access point is configured to monitor, eg, on a per-device basis, for one or more failures that may prevent the UE device from executing via The monitored access point successfully accesses the Internet or another network. A packet can be, and sometimes is, a packet used to convey messages and/or information as part of a connection establishment process or one or more operations used to establish Internet connectivity.

In response to detecting a failure corresponding to the device, the access point sends a failure notification to the network monitoring device along with buffered packets received from or sent to the device prior to detecting the failure. Thus, by buffering packets before a user or access point reports or detects a failure, a network node can be made aware of blocking or interfering with a connection to the Internet or otherwise before a user of the device reports a failure and/or otherwise attempts to receive help with the problem. The failure of a network device.

In accordance with the present invention, buffered packets corresponding to devices can, and often are, deleted upon successful network connectivity (such as successful Internet access) that can, and sometimes is, be Indicates a DNS lookup operation used to obtain an address for another device to connect to on the Internet. While the access point may be configured to buffer packets to facilitate failure analysis prior to enabling Internet access, the network monitoring node may configure the access point to buffer packets received or sent to the device until, for example, authentication, authorization, and accounting are completed. A fee (AAA) operation, a successful DHCP server access, or a successful radio connection establishment are different points.

Monitoring at the access point can be configured on different types of interfaces to monitor the same or different faults. Failures can be of different types that interfere with the establishment of a network connection, but in some cases may not interfere with communications (eg, radio link communications) between the access point and the wireless terminal, such as in many cases by Packet errors that are corrected using an error correction code before storing the packet in the buffer. Fault monitoring can be customized to take into account the type of interface to be monitored. By allowing the same network device to configure different types of access points and/or different types of interfaces at the access points, a centralized level of failure detection across access points of different types and/or communication technologies can be achieved. Furthermore, since monitoring can be performed from a remote location, monitoring can be performed by an entity other than the owner of the access point. This avoids the need for the access point owner to understand networking issues and/or overall network topology that the network monitoring node may consider when trying to diagnose the cause of various reported failures.

Packets that were buffered prior to achieving successful Internet or network connectivity are typically deleted for individual devices when successful network connectivity (eg, Internet access) is achieved. However, in some embodiments, a network node that configures monitoring and forwards packets to it in the event of a failure detected may also control monitoring of specific wireless terminals capable of Internet connectivity, but may provide customers with keep-alive and / or problems tending to excessively switch between access points.

In some embodiments, the network monitoring node instructs the plurality of access points to monitor and forward packets corresponding to specifically identified UE devices, regardless of detection of fault conditions. As the UE device moves throughout one or more networks, the access point captures and forwards packets transmitted from or to the UE device, and also reports connectivity information, such as when and how long the UE device is connected to The access point that reported this information. Monitoring from one or more different types of network connections and/or access points used by the UE device to the network over a period of time by having the different types of access points capture and forward packets and connectivity information corresponding to the UE device Nodes provide connectivity information. From this information, patterns can be identified that promote problems with settings or other configuration issues that may lead to excessive handovers that do not prevent a connection to the Internet from being established, but may degrade service due to excessive handovers, or may result in undesired way to overuse one interface (eg, LTE) over another (eg, WiFi).

While various embodiments have been discussed in the above summary, it should be appreciated that not all embodiments necessarily include the same features, and that some of the features described above are not required for all embodiments. Numerous additional features, embodiments, and benefits of various embodiments are discussed in the detailed description below.

Description of drawings

FIG. 1 is an illustration of an exemplary system in accordance with an exemplary embodiment.

Figure 2 illustrates an exemplary network monitoring node according to an exemplary embodiment.

3 illustrates an exemplary access point (eg, a base station) in accordance with an exemplary embodiment.

4A is a first portion of a flowchart of an exemplary method of capturing and providing information related to communications (eg, wireless communications) in accordance with an exemplary embodiment.

4B is a second portion of a flowchart of an exemplary method of capturing and providing information related to communications (eg, wireless communications) in accordance with an exemplary embodiment.

4C is a third portion of a flowchart of an exemplary method of capturing and providing information related to communications (eg, wireless communications) in accordance with an exemplary embodiment.

4D is a fourth portion of a flowchart of an exemplary method of capturing and providing information related to communications (eg, wireless communications) in accordance with an exemplary embodiment.

4E is a fifth portion of a flowchart of an exemplary method of capturing and providing information related to communications (eg, wireless communications) in accordance with an exemplary embodiment.

4F is a sixth portion of a flowchart of an exemplary method of capturing and providing information related to communications (eg, wireless communications) in accordance with an exemplary embodiment.

Figure 4 includes the combination of Figures 4A, 4B, 4C, 4D, 4E and 4F.

5A is a first portion of an assembly of modules that may be included in an exemplary network monitoring node, according to an exemplary embodiment.

5B is a second portion of an assembly of modules that may be included in an exemplary network monitoring node, according to an exemplary embodiment.

Figure 5 includes the combination of Figures 5A and 5B.

6A is a first portion of an assembly of modules that may be included in an exemplary access point, according to an exemplary embodiment.

6B is a second portion of an assembly of modules that may be included in an exemplary access point, according to an exemplary embodiment.

Figure 6 includes the combination of Figures 6A and 6B.

7 is an illustration of an exemplary communication device (eg, a UE device) in accordance with an exemplary embodiment.

Detailed ways

FIG. 1 is an illustration of an exemplary system 100 implemented in accordance with an exemplary embodiment. The example system 100 includes a plurality of devices including a management entity 102, a Dynamic Host Configuration Protocol (DHCP) server 104, a Domain Name System (DNS) server 106, authentication, authorization and accounting including a plurality of AAA servers 110, . . . , 112. A fee (AAA) system, a Mobility Management Entity (MME) 113 (which may be an LTE MME or another entity for maintaining user equipment (UE) device information and managing device mobility), and coupled together by a network connection 116 and/or network storage device 114 directly coupled to the Internet 117 or other network.

Connected to the communication network 117 (eg, the Internet) are customer premises (customer premises 1 118, . . . , customer premises Y 118') and wireless base stations (wireless base station 1 132, . . . , wireless base station M 132'). In some embodiments, the customer premises (customer premises 1118, . . . , customer premises Y 118') each include a gateway device 120 that operates as an Internet access point. In the example of FIG. 1 , the gateway 120 device includes a network interface, such as a cable, FIOS or DSL interface, that provides a wired (wherein the conductors may include fiber optic conductors) connection to the Internet 117 . Included in gateway 120 is an Ethernet switch and/or router 124 and a WiFi and/or Bluetooth wireless access point 126 that can communicate with the Internet via network interface 122 . The Ethernet switch/router 124 operates as a wired access point through which devices (eg, UE devices H1 128, . . . , UE devices HZ 130) can access the ) is connected to the Internet, while the wireless access point 126 acts as a wireless access point. While the access points ( 124 , 126 ) are shown as part of the gateway device 120 , the customer premises 118 may include an Ethernet switch/router 124 or a WiFi access point 126 that interfaces directly to the Internet 117 . Accordingly, the examples of the access points 124, 126 being part of the gateway 120 are exemplary and not critical to the present invention in any way.

UE devices (UE devices H1 128, . . . , UE devices HN 130) located at Customer Premises 1 are successfully attached upon successful wireless connection to the access point 132, . AAA can communicate with AAA upon reaching one of the access points 124 or 126 or UE devices (UE device 1 134 (eg, mobile node 1), ..., UE device N 134' (eg, mobile node N)) The system 108 interacts to be authorized for Internet services, access the DHCP server 104 to obtain the address of the DNS server 106 and/or other information that can be used to access the Internet, and can use the DNS server 106 to resolve URLs to IP addresses, thereby allowing communication with The device corresponding to the IP address communicates successfully. It should be appreciated that failure to successfully attach to access point 124, 126, 132, or 132' or to obtain services or information from AAA system 108, DHCP server 104, or DNS server 106 can interfere with Internet access by UE devices (eg, successful use of the UE 128, 130, 134 or 134').

Devices coupled to the network 116 may communicate with other devices via the network or the Internet 117 . The management entity 102 is a network node that can communicate via the Internet 117 with the base stations 132, 132' and devices at the customer premises 118, 118', including the gateway device 120 and the access points 124 and 126 included therein. Thus, the management entity 102, which may be considered a backend entity (since it is not located at a customer premises or a base station), may, and according to some embodiments, send control and configuration information to various access points of different types. In some embodiments, the management entity 102 is a network monitoring node. Although shown as a single node in Figure 1, in some embodiments the functionality of the management entity may, and does, be implemented in a distributed fashion. It should be appreciated that the management entity 102 may be a different entity than that used for normal telephone call setup, and may not be in the call setup or signaling path of a VoIP call or other Internet-based communication session. Thus, in some embodiments, the management entity 102 is not in snooping or direct monitoring may be exchanged between communication endpoints, between the DHCP server 104 and the UE device, between the DNS server 106 and the UE device, or the AAA system 108 and the UE or base station The location of session establishment or control signaling. However, the access point to which the UE device is attached is often in the data and control path of such communications.

Communication between devices coupled to access points such as wireless base stations 132, 132' and/or gateway device 120 may occur once successful Internet access has been achieved. Such Internet access may fail for any of a number of reasons, the reasons for which cannot be collected that may assist in the detection and/or determination of failure causes that interfere with, for example, communications over a communication network such as the Internet 117 The network failure information and packets are directly observed by the management entity 102.

Thus, via the communication network 117 (eg, the Internet), the management entity 102 may communicate with wireless access points (eg, The base stations 132, 132') send configuration instructions. In addition, the management entity 102, which includes processors, memory, and network interfaces, as discussed below, may receive failure notification messages reporting the detected failure or failures, as well as buffered packets associated with the detected failures. Before a failure is detected, the packets may have been collected by the access point, also sometimes referred to as a failure, and a failure notification message is provided to the management entity. The management entity 102 may configure different types of access points and thus may receive failure messages from devices attempting to connect via different networks and/or interfaces. This is particularly useful when diagnosing network problems for multi-mode devices that can switch between using different types of networks (eg, LTE, WiFi, Bluetooth, etc.).

The management entity may run what may be referred to as backend cloud software that controls one or more of the access points 124, 126, 132, 132' to capture packets before, for example, causing a failure, thereby dynamically monitoring Connectivity failures and report detected failures and packets that prevent devices from connecting to the Internet or access points. Packet capture may be on one, some or all data interfaces of the access point under the direction of management entity 102, which may instruct the access point to perform packet buffering and communication failure monitoring on one or more interfaces. Access point interfaces that may be configured by management entity 102 include Ethernet interfaces (eg, Ethernet interface 150 included in Ethernet switch router 124 ), and radio interfaces (eg, WiFi interfaces included in wireless access point 126 ) 152 (eg, 802.11 interface), Bluetooth interface 154, and Bluetooth Low Energy (BLE) interface 156). Each interface (150, 152, 154, 156) includes a receiver and a transmitter. As part of the packet capture process, an access point performing monitoring and packet capture can create a packet capture file that includes metadata associated with packet data corresponding to the device for which the failure was detected or for which the access point has been configured , so that packets can be captured and forwarded even when no failures are detected. For example, for 802.11 packets, in some embodiments metadata that is also captured and stored includes a radiotap header with 802.11 metadata, such as signal strength, packet rate, receive status, and transmit status.

The management entity 102 may control and configure the access point to capture multiple dimensions of information as part of the packet capture process in the access point.

For example, a management entity may configure one or more access points or specific access points to monitor and collect information and/or set various collection-related settings. In some embodiments, management entity 102 may perform one, more, or all of the following:

i) the type of connectivity related failures to be detected and reported - e.g. association failures, authentication/authorization failures, DHCP failures, DNS lookup failures can be specified;

ii) may indicate the number of broadcast and multicast packets captured during connectivity and be provided in the event that a connectivity failure corresponding to the device is detected;

iii) may indicate the total number of packets to be captured for the device and the packet length; and

iv) Whether to enable or disable packet capture and to detect and report connection failures and associated buffered packets/information can be specified.

In some embodiments, the management entity 102 is configured to disseminate a packet capture configuration, eg, control information for controlling packet capture operations at one or more access points, as well as a service set identifier (SSID) Features across devices (eg, access points) on a site-based, site-based, or other basis.

When an access point receives configuration information related to packet capture, it configures its interface, depending on the configuration information, to perform one or more of the following capture and/or packet upload related operations:

i) monitoring new client (eg, device) connection settings and renewals (such as DHCP renewals), 801.1x re-authentication, Wi-Fi Protected Access (WPA) Group Temporary Key (GTK) re-keying;

ii) proactively seek (eg, monitor) to detect, configure and/or connect failure conditions, such as events, messages or packets indicating a failure related to a connection;

iii) store (eg, buffer) a copy of the client connection packet in internal memory for possible upload in the event of a failure or other upload condition being met; and

iv) in response to detecting a failure, e.g. when one of the monitored failure conditions is detected, generating a corresponding event notification in response to detecting a failure, e.g. a notification with information providing information describing or indicating the type of failure detected , a copy of the buffered packets corresponding to the device (eg, client) corresponding to the failure, and the packets stored in memory for the devices involved in the failure before the failure and, optionally, after the failure was detected s copy. Fault notifications, packets and related information are sent to the management entity 102 for storage and processing.

In some but not necessarily all embodiments, the management entity 102 responds to failure notifications by taking one, more, or all of the following actions for each failure event:

i) storing failure events in a log, implemented in some but not necessarily all embodiments in a horizontally scalable NoSQL database, where failure notification information and links to captured packets are stored;

ii) storing the packet providing the fault notification in a network storage device or cloud database, for example in a secure manner, such as by using encryption and a pointer to a network storage location available in the event log database as part of the event log, The event log is created corresponding to the failure notification received;

iii) provide external clients with access to stored groupings, logs and associated event details via a web interface;

iv) analyzing the failure of the access point and/or UE configuration settings causing the failure;

v) transmit the new configuration information to the access points or UEs involved in the failure to avoid recurrence of the failure and, optionally, control the access points or UEs according to the information provided by the management entity 102 (eg network monitoring node) Automatic reconfiguration of new configuration information; and

vi) Determine that additional failure conditions/anomalies are possible, and configure the access point to collect groups of corresponding expected failures and/or client devices (eg, UEs) that may experience future failure conditions or anomalies that degrade service log. A few examples of such behavior are that if there is an anomaly in the connection time associated with a client on a given SSID, the management entity 102 can, and sometimes does, respond dynamically, eg, in response to a detected failure or condition In automatic response, packet capture is turned on on UE devices in a given site/organization for all new client (eg, device) connections. Another example is that if the management entity 102 detects that a particular client is behaving abnormally, it may instruct multiple devices (eg, multiple access points) to follow and capture packets for a given client and forward the captured packets to The management entity 102, whether or not a new failure is detected. Enabling packet buffering and reporting of devices in the absence of detected failures is dynamic and can be controlled based on machine learning that some failures may be associated with other failures that may not be detected.

The management entity 102 allows the amount of packet buffering, fault detection and reporting to vary depending on individual customer needs and/or network requirements.

The management entity has a level of access point configuration control that enables clients who by default do not want to use packet capture and reporting of all failures and only want to dynamically turn on failure detection and monitoring on a per-device or limited failure condition checking basis once the network detects Check if the user reports one or more failure conditions. For example, failures may be automatically or manually enabled when a device in communication network 100 (eg, one of AAA server 110 or 112 or DHCP server 104 ) detects a particular client device 128, 130, 134 or 134' authentication or DHCP failure Pre-packet capture. In this case, if a particular client fails once, there is a good chance it will fail again, and it would be useful to automatically enable packet buffering and reporting for that device in the future.

In some embodiments, upon detection of a failure of a particular client, the management entity 102 establishes a connection for a given client device in multiple (eg, all) access points 134, 134', 124, 126 in the network Packet capture is automatically enabled during this period, regardless of which interface the access point supports. In some embodiments, the management entity 102 monitors how many packet data and/or failure notifications it has received for a particular UE device, and when the management entity 102 has logged enough failure and/or packet capture data to analyze and determine the cause of the failure , the management entity communicates to the access point that the access point should stop packet capture for the client device experiencing the failure, thereby dynamically stopping the packet capture corresponding to the device experiencing the failure.

In some embodiments, when the management entity 102 detects that multiple clients have failed to connect on a given SSID or access point (AP). If an anomaly is detected for a given SSID, in some embodiments, the management entity 102 enables (eg, configures the access point) the access point to use the SSID on which the fault or anomaly was detected as new (eg, all new) A client device (eg, a UE) or alternatively only performs packet capture for a given device that detected a failure. After collecting enough failure samples, the management entity 102 stops packet capture and reporting related to the SSID or device corresponding to the detected failure.

The described methods and apparatus provide a scalable solution for dynamic packet capture in an automated manner, eg, without human intervention, and thus enable intelligent network automation. Furthermore, the cause of the failure is identified and new access point or UE configuration information is automatically propagated to correct the configuration problem that caused the failure and avoid such failures in the future.

FIG. 2 is an illustration of an exemplary network monitoring node 200 in accordance with an exemplary embodiment. In some embodiments, the network node 200 of FIG. 2 is the management entity 102 of the system 100 of FIG. 1 . The network management node 200 includes a communication interface 202 (eg, an Ethernet interface 202 ), a processor 206 , an output device 208 (eg, a display, a printer, etc.), an input device 210 (eg, a keyboard, a keypad, etc.) coupled together via a bus 218 , touch screen, mouse, etc.), memory 212 , and assembly of modules 216 (eg, assembly of hardware modules, such as circuits), the various elements may exchange data and information over bus 218 . Communication interface 202 couples network monitoring node 200 to the network and/or the Internet. The communication interface 202 includes a receiver 220 via which the network monitoring device 200 can receive data and information, including, for example, failure notifications and captured packets forwarded from the access point, and a transmitter 222 through which the network monitoring device 200 can send The controller 222 sends data and information, including, for example, configuration information, monitoring commands, notification commands, and packet capture instructions to the access point.

Memory 212 includes routines 228 and data/information 230 . Routines 228 include assembly of modules 232 (eg, assembly of software modules). Data/information 230 includes generated monitor commands 234 , generated notify commands 235 , generated packet capture instructions 238 , received failure notifications 240 , received forwarded capture packets 242 , and evaluation results 244 .

3 is an illustration of an exemplary access point 300 (eg, a base station) in accordance with an exemplary embodiment. In some embodiments, the base stations of Figure 1 (Base Station 1 132, 132') are the same as the access point 300 of Figure 3 . In some embodiments, gateway device 120 of FIG. 1 is the same as access point 120 of FIG. 1 .

The access point 300 includes a wired interface 302, a wireless interface 304, a processor 306 (eg, a CPU), a memory 312, and an assembly of modules 308 (eg, an assembly of hardware modules, such as an assembly of circuits) coupled together via a bus 309, Various elements may exchange data and information over bus 309 . The wired interface 302 includes a first wired interface 330 and a second wired interface 332 , the first wired interface 330 includes a receiver 332 and a transmitter 334 , and the second wired interface 332 includes a receiver 336 and a transmitter 338 . The first wired interface couples the access point 300 to the network and/or the Internet. A second wired interface 332 (eg, an Ethernet interface) couples the access point 300 to the Ethernet network. In one embodiment, the first wired interface 330 is the network interface 122 of the device 120 of FIG. 1 , and the second wired interface 332 is the Ethernet interface 150 of the device 120 of FIG. 1 . The wireless interface 304 includes a BLE interface 340 , a WiFi interface 342 (eg, an 802.11 interface), a Bluetooth interface 344 and a cellular interface 346 . The BLE interface 340 includes a receiver 348 coupled to a receive antenna 349 via which the access point can receive wireless signals from a communication device (eg, a wireless terminal), and a transmitter 350 coupled to a transmit antenna 351 via which the access point can receive Wireless signals are transmitted to a communication device (eg, a wireless terminal) via transmit antenna 351 . WiFi interface 342 includes a receiver 352 coupled to a receive antenna 353 via which the access point can receive wireless signals from a communication device (eg, a wireless terminal), and a transmitter 354 coupled to a transmit antenna 355 via which the access point can receive Wireless signals are transmitted to a communication device (eg, a wireless terminal) via transmit antenna 355 . The Bluetooth interface 344 includes a receiver 356 coupled to a receive antenna 357 via which the access point can receive wireless signals from a communication device (eg, a wireless terminal), and a transmitter 358 coupled to a transmit antenna 359, the access point Wireless signals may be transmitted to communication devices (eg, wireless terminals) via transmit antenna 359 . The cellular interface 346 includes a receiver 360 coupled to a receive antenna 361 via which the access point can receive wireless signals from communication devices (eg, wireless terminals), and a transmitter 362 coupled to a transmit antenna 363, the access point Wireless signals may be sent to a communication device (eg, a wireless terminal) via transmit antenna 363 . In some embodiments, the same antenna is used for one or more different wireless interfaces. In one embodiment, (BLE interface 340 , WiFi interface 342 , Bluetooth interface 344 ) of access point 300 are the same as those of gateway device 120 of FIG. 1 (BLE interface 156 , WiFi interface 152 , Bluetooth interface 154 ), respectively.

Memory 312 includes routines 314 and data/information 316 . Routines 314 include assembly of modules 318 (eg, assembly of software modules), and application programming interfaces (APIs) 320 . Data/information 316 includes configuration information 322, packet capture files 324, and generated failure event notifications 326.

Figure 4, which includes the combination of Figures 4A, 4B, 4C, 4D, 4E, and 4F, is a flow diagram of an exemplary method of capturing and providing information related to communications (eg, wireless communications), according to an exemplary embodiment Figure 400. Exemplary operations begin in step 402 and proceed to step 404 . In step 404, the network monitoring node is operated to transmit monitoring command information to one or more access points. For example, in one exemplary embodiment, the method of step 404 of FIG. 4 is performed by the management entity 102 of the system 100 of FIG. 1 , which is a network monitoring node implemented according to the network monitoring node 200 of FIG. 2 . In some embodiments, the access point is a wireless access point. For example, the access points are the access points 124 , 126 , 132 , 132 ′ of the system 100 of FIG. 1 implemented in accordance with the access point 300 of FIG. 3 . Step 404 includes steps 406 and 408 .

In step 406, the network monitoring node is operated to transmit at least a first monitoring command to configure the first access point to monitor to detect a communication failure corresponding to a communication device using the first access point. In some embodiments, the first access point is a wireless access point and the communication device is a wireless device. For example, the first access point is one of access point 126, access point 132, and access point 132', and the communication device includes UE H 1128, . . . , UE HA 130, One or more or all of UE 1 134, ..., UE N 134'. In some embodiments, the first monitoring command is a command instructing the first access point to monitor to detect a specified communication failure corresponding to any communication device using the first access point. In some embodiments, the first monitoring command is a command instructing the first access point to monitor to detect a specified communication failure corresponding to a particular communication device that may use the first access point. In some embodiments, the first monitoring command is a command instructing the first access point to monitor packets corresponding to a specific portion of a communication operation (eg, a post Internet connection) and a specific communication device. The method allows for packet capture and reporting of specific communication devices (eg, wireless terminals) and specific parts of a communication session even when no errors are detected, to facilitate detection of problems or errors that do not themselves explicitly indicate a problem or error when considered but change over time Problems that pass may indicate an error in a particular part of a communication session, for example, a device can repeatedly disconnect on an interface and disconnect due to errors or problems with/communication associated with an interface, etc. (such as a time-out setting that is shorter than appropriate) Connect to another interface immediately after a successful connection is established.

In step 408, the network monitoring node is operated to transmit at least a first monitoring command to configure the Nth access point to monitor to detect communication failures corresponding to communication devices using the Nth access point. Operation proceeds from step 404 to step 410 .

In step 410, the access point is operated to receive monitoring command information. Step 410 includes step 412 and step 414 . In step 412, the first access point is operated to receive configuration information from a network monitoring node, the configuration information indicating that the first access point is to monitor for detected communication failures, eg, based on each access point interface . In some embodiments, the first access point includes a plurality of distinct interfaces, and information from the network monitoring mode is provided on a per access point interface basis indicating communication failures to be monitored by the first access point. In some such embodiments, the plurality of different interfaces includes two different wireless interfaces. Exemplary different wireless interfaces include cellular wireless interfaces, WiFi wireless interfaces (eg, 802.11 interfaces), Bluetooth wireless interfaces, and BLE wireless interfaces. In some embodiments, the information indicative of communication failures to be monitored by the first access point includes one or more of the following: association failures, authentication failures, authorization failures, and DNS lookup failures. Step 412 includes one or more or all of steps 416 , 418 , 420 and 422 . In step 416, the first access point receives information indicating that the first access point will monitor for association failures. In step 418, the first access point receives information indicating that the first access point is to monitor for authorization failures. In step 420, the first access point receives information indicating that the first access point is to monitor for Dynamic Host Configuration Protocol (DHCP) failures. In step 422, the first access point receives information indicating that the first access point will monitor for Domain Name System (DNS) lookup failures. In step 414, the Nth access point is operated to receive configuration information from a network monitoring node, the configuration information indicating that the Nth point is to monitor for detected communication failures, eg, on a per access point interface basis. Operation proceeds from step 410 to step 424 .

In step 424, the network monitoring node is operated to transmit failure notification command information to one or more access points. Step 424 includes steps 426 and 428. In step 426, the network monitoring node is operated to transmit at least a first notify command to configure the first access point to notify the network monitoring node of the detected failure. In step 428, the network monitoring node is operated to transmit at least a first notify command to configure the Nth access point to notify the network monitoring node of the detected failure. Operation proceeds from step 424 to step 430 .

In step 430, the access point(s) are operated to receive failure notification command information. Step 430 includes steps 432 and 434 . In step 432, the first access node is operated to receive from the network monitoring node one or more notification commands including the first notification command, eg the notification command(s) sent in step 426. In step 432, the Nth node is operated to receive from the network monitoring node one or more notification commands including the first notification command, such as the notification command(s) sent in step 428. Operation proceeds from step 430 to step 438 via connecting node A 436 .

In step 438, the network monitoring node is operated to communicate packet capture instruction information to one or more access points. Step 438 includes steps 440 , 442 , 444 and 446 . In step 440, the network monitoring node is operated to transmit packet capture instructions to a first access point to configure the first access point to capture and buffer packets corresponding to communication devices using the first access point . In step 442, the network monitoring node is operated to transmit packet capture instructions to the Nth access point to configure the Nth access point to use the Nth access point to capture and buffer packets corresponding to communication devices . In step 444, the network monitoring node is operated to transmit packet capture instructions for the second communication device to the plurality of access points. In some embodiments, the packet capture instructions include instructions for capturing packets corresponding to the second communication device on any interface through which the second communication device communicates with the access point. In some such embodiments, the packet capture instructions include instructions for forwarding captured packets corresponding to the second communication device even in the event that a communication failure corresponding to the second communication device is not detected. In some embodiments, the packet capture instructions include instructions for capturing and forwarding packets corresponding to the indicated portion of the communication activity of the second communication device. In some embodiments, the packet capture instructions include instructions for forwarding captured packets corresponding to the second communication device that were captured after the second communication device has achieved successful Internet connectivity. In some such embodiments, the packet capture instructions include instructions for forwarding captured packets corresponding to the second communication device after the second communication device has achieved successful Internet connectivity, but not at that captured before the point. In some embodiments, the packet capture instructions include instructions to capture packets corresponding to the second communication device on a specified set of interfaces on which the second communication device may communicate with an access point, the specified The set of is less than the entire set of interfaces that can be used by the second communication device to communicate with the access point. In some embodiments, the packet capture instructions include identifying a set of interfaces (eg, a set of interfaces that are a subset of the full set of available interfaces that can be used by the second communication device) and identifying and forwarding packets to be captured and forwarded to network monitoring Instructions for one or more selected portions of the communication activity of the mode, regardless of the fault state. In some such embodiments, the one or more selected portions of the communication activity are smaller than the full set of possible portions of the communication activity.

In step 446, the network monitoring node is operated to transmit packet capture instructions for the Xth communication device to the plurality of access points. Operation proceeds from step 438 to step 448 .

In step 448, one or more access points are operated to receive packet capture instruction information. Step 448 includes steps 450 and 452. In step 450, the first access point is operated to receive packet capture instruction information. In step 452, the Nth access point is operated to receive packet capture instruction information. Step 450 includes one or more or all of steps 454 , 456 , 458 , 460 , 464 and 466 .

In step 454, the first access point is operated to receive information from the network monitoring node indicating the number of broadcast and multicast packets corresponding to the communication device to capture during an attempt by the communication device to achieve network connectivity. In step 456, the first access point is operated to receive information from the network monitoring node indicating the total number of packets and an indicator of the length of the packets captured and buffered for each communication device using the first access point. In step 458, the first access point is operated to receive a command from the network monitoring node to enable or disable packet capture at the first access point. In step 460, the first access point is operated to receive instructions to capture packets for the identified communication device on a plurality of different interfaces. In step 464, the first access point is operated to receive packet capture instructions for the second communication device from a network monitoring node, the instructions being directed to a plurality of access points including the first access point. In step 466, the first access point is operated to receive packet capture instructions for the Xth communication device from a network monitoring node, the instructions being directed to a plurality of access points including the first access point.

Operation proceeds from step 448 to steps 470 and 471 via connecting Node B 468 .

In step 470, the first access point is configured to forward captured packets corresponding to the one or more identified communication devices to the network monitoring node regardless of whether a communication failure corresponding to the identified communication devices is detected or not . For example, in step 470, the first access point configures itself to forward captured packets corresponding to the identified devices identified in the instructions received in step 460, regardless of whether or not detected Communication failure corresponding to the device. Operation proceeds from step 470 to step 472 .

In step 472, the first access point is configured to forward the captured packets corresponding to the communication device that detected the communication failure, without forwarding the identification that the communication failure is not detected and the packet is not to be forwarded regardless of the failure status The captured packet corresponding to the communication device of the communication device. Operation proceeds from step 472 to step 476 via connecting node C 474 .

In step 476, the first access point is operated to capture packets corresponding to the communication device using the first access point. Operation proceeds from step 476 to step 478 . In step 478, the first access point stores the captured packets in a buffer (eg, a buffer in memory in the first access point). Operation proceeds from step 478 to the input of step 476, and to steps 480 and 482.

In step 480, a first access point is operated to monitor to detect communication failures corresponding to the communication device using the first access point. Operation proceeds from step 480 to step 484 . In step 484, the first access point determines whether a communication failure has been detected and controls operation based on the determination. If a failure is detected, operation proceeds from step 484 to step 486 . In step 486, in response to detecting a communication failure corresponding to a communication device (eg, a first communication device) using the first access point, the first access point generates an indication at the first access point that a detected The event failure notification for the type of failure. Operation proceeds from step 486 to step 488. In step 488, the first access point sends the generated event failure notification from the first access point to the network monitoring node. Operation proceeds from step 488 to step 490 . In step 490, the first access point forwards the captured packets corresponding to the communication device (eg, the first communication device) corresponding to the detected failure to the network monitoring node. Operation proceeds from step 490 to step 4003 via connecting node E 4001 .

Returning to step 484, if a failure has not been detected, then operation proceeds from step 484 to step 492. In step 492, the first access point checks and determines whether a packet buffering stop criterion for a potential failure of the communication device has been reached, eg, Internet access has been enabled for the communication device. If the determination of step 492 is that the packet buffering stop criterion has been reached, then operation proceeds from step 492 to step 494 . In step 494, the first access point deletes the stored packets corresponding to the communication device that were stored prior to reaching the packet buffering stop criterion. In some embodiments, step 494 includes step 496 in which the first access point deletes the stored packets corresponding to the communication device that were stored prior to the DNS lookup after the communication device successfully completed the DNS lookup.

Returning to step 482, in step 482, the first access point is operated to monitor for packets corresponding to the identified communication device(s) to which the packet is to be forwarded, regardless of failure detection. Operation proceeds from step 482 to step 498. In step 498, if a packet is detected corresponding to an identified device to which the first access point will forward the packet regardless of the failure criteria, then operation proceeds from step 498 to step 4981, in which the first access point operates point to forward captured packets corresponding to the identified communication device to the network monitoring node regardless of whether a communication failure corresponding to the identified communication device is detected. Operation proceeds from step 4981 to step 4003 via connecting node E 4001.

In some embodiments, the identified communication device (eg, wireless terminal) is a multi-mode communication device, and a communication failure on the first interface (eg, the first wireless interface) causes the identified communication device to switch to the second interface (eg, a second wireless interface). In some such embodiments, the first and second interfaces are different types of wireless interfaces. In some such embodiments, the first interface is one of: a WiFi interface, a Bluetooth interface, a BLE interface, and a cellular interface, and the second interface is a different one of the following: a WiFi interface, a Bluetooth interface, a BLE interface, and a cellular interface .

Returning to step 471, in step 471, the Nth access point is configured to forward captured packets corresponding to one or more of the identified communication devices to the network monitoring node, regardless of whether communication with the identified communication is detected or not. Communication failure corresponding to the device. Operation proceeds from step 471 to step 473 .

In step 473, the Nth access point is configured to forward the captured packet corresponding to the communication device that detected the communication failure, without forwarding the identification that the communication failure is not detected and the packet is not to be forwarded regardless of the failure status The captured packet corresponding to the communication device of the communication device. Operation proceeds from step 473 to step 477 via connecting node D 475 .

In step 477, the Nth access point is operated to capture packets corresponding to communication devices using the Nth access point. Operation proceeds from step 477 to step 479 . In step 479, the Nth access point stores the captured packets in a buffer (eg, a buffer in memory in the Nth access point). Operation proceeds from step 479 to the input of step 477, and to steps 481 and 483.

In step 481, the Nth access point is operated to monitor to detect a communication failure corresponding to the communication device using the Nth access point. Operation proceeds from step 481 to step 485 . In step 485, the Nth access point determines whether a communication failure has been detected and controls operations based on the determination. If a failure is detected, operation proceeds from step 485 to step 487 . In step 487, in response to detecting a communication failure corresponding to a communication device using the Nth access point, the Nth access point generates an event failure notification at the Nth access point indicating the type of detected failure . Operation proceeds from step 487 to step 489 . In step 489, the Nth access point sends the generated event failure notification from the Nth access point to the network monitoring node. Operation proceeds from step 489 to step 491 . In step 491, the Nth access point forwards the captured packets corresponding to the communication device corresponding to the detected failure to the network monitoring node. Operation proceeds from step 491 to step 4003 via connecting node E4001.

Returning to step 485, if no fault is detected, then operation proceeds from step 485 to step 493. In step 493, the Nth access point checks and determines whether a packet buffering stop criterion for a potential failure of the communication device has been reached, eg, Internet access has been enabled for the communication device. If the determination of step 493 is that the packet buffering stop criterion has been reached, then operation proceeds from step 493 to step 495 . In step 495, the Nth access point deletes the stored packets corresponding to the communication device that were stored prior to reaching the packet buffering stop criterion. In some embodiments, step 495 includes step 497 in which the Nth access point deletes the stored packets corresponding to the communication device that were stored prior to the DNS lookup after the communication device successfully completes the DNS lookup.

Returning to step 483, in step 483, the Nth access point is operated to monitor for packets corresponding to the identified communication device(s) for which packets are to be forwarded, regardless of failure detection. Operation proceeds from step 483 to step 499 . In step 499, if a packet corresponding to the identified device to which the Nth access point is to forward the packet is detected regardless of failure criteria, then operation proceeds from step 499 to step 4991, where the Nth access point is operated to transfer the packet to Captured packets corresponding to the identified communication device are forwarded to the network monitoring node regardless of whether a communication failure corresponding to the identified device has been detected. Operation proceeds from step 4991 to step 4003 via connecting node E 4001.

In step 4003, the network monitoring node is operated to receive failure notifications, captured packets corresponding to detected failures, and/or captured packets corresponding to identified communication devices. Operation proceeds from step 4003 to step 4005.

In step 4005, the network monitoring node is operated to analyze received failure notifications, captured packets corresponding to detected failures, and/or captured packets corresponding to identified communication devices. Step 4005 includes one or more of steps 4007 , 4009 , 4011 , 4013 , 4015 and 4017 . In step 4007, the network monitoring node detects (eg, dynamically detects) a DHCP server configuration error. In step 4009, the network monitoring node detects (eg, dynamically detects) that a large number (eg, an amount exceeding a predetermined threshold) of authentication failures are driven by timeouts during the handshake (eg, due to poor coverage, failures, and/or retries) , eg via analysis of dynamically captured packets. In step 4011, the network monitoring node detects (eg, dynamically detects) an authentication failure or a DHCP failure related to a WLAN/SSID configuration, eg, a bad WLAN or a bad server IP. In step 4013, the network monitoring node detects (eg, dynamically detects) that the failure is associated with a single device, while other devices are functioning normally. In step 4015, the network monitoring node detects (eg, dynamically detects) that the failure is associated with a single WLAN, while the other WLANs are functioning normally. In step 4017, the network monitoring node detects anomalies based on analysis of stored packet captures over long periods of time (eg, hours or days). Operation proceeds from step 4005 to step 4019. In step 4019, the network monitoring node is operated to take corrective action in response to the analysis of step 4005. Step 4019 includes one or more or all of steps 4021 , 4023 , 4025 , 4027 , 4029 and 4031 . In step 4021, in response to detecting a misconfigured DHCP server in step 4007, the network monitoring node sends commands and/or notifications to reconfigure the DHCP server. In step 4023, the network monitoring node sends control message(s) to improve air link channel quality in response to the detection in step 4009 of a large number of authentication failures driven by timeouts during the handshake. For example, network monitoring nodes use radio management software to modify or control TX power and/or channel modification to improve air link quality. In step 4025, the network monitoring node sends an anomaly detection notification to the network administrator in response to detecting in step 4011 that the authentication failure or DHCP failure is related to the WLAN and/or SSID configuration, eg, including identifying a suspected bad WLAN IP or suspicious information about the bad server IP. In step 4027, in response to detecting in step 4013 that the failure is associated with a single device, the network monitoring node sends a command to reboot the detected device associated with the failure. In step 4029, in response to detecting in step 4015 that the failure is associated with a single WLAN, the network monitoring node sends a command to restart the access point corresponding to the WAN associated with the failure. In some embodiments, in step 4029, in response to detecting in step 4015 that the failure is associated with a single WLAN, the network monitoring node sends a command to restart multiple access points, eg, multiple access points corresponding to the WAN associated with the failure A collection of access points. In step 4031, in response to the anomaly detected in step 4017, the network monitoring node sends a notification of the detected anomaly to the network administrator based on the long-term packet capture analysis.

FIG. 5 , which includes the combination of FIGS. 5A and 5B , is a diagram of an exemplary assembly of module 800 , including part A 801 and part B 803 , according to an exemplary embodiment. In some embodiments, assembly of module 800 is included in a network monitoring node (eg, network monitoring node 200 of FIG. 2 or management entity 102 of FIG. 1 ) implemented in accordance with exemplary embodiments.

The modules in the assembly of module 800 may, and in some embodiments are, be implemented entirely in hardware within a processor (eg, processor 208 ), eg, as separate circuits. The modules in the assembly of modules 800 may, and in some embodiments are, be implemented entirely in hardware within the assembly of modules external to the processor, eg, as separate circuits corresponding to different modules, such as the assembly of module 216 . In other embodiments, some of the modules are implemented as circuits, eg, circuits, within the processor, while other modules are implemented as circuits and assemblies of modules, eg, within modules external to the processor and coupled to the processor. As should be appreciated, the level of integration of modules within the processor and/or with some modules external to the processor may be one of design choices.

Alternatively, rather than being implemented as circuits, all or some of the modules may be implemented in software and stored in the memory of the device, where the modules control the operation of the device to implement the functions corresponding to the modules when the modules are executed by the processor. In some such embodiments, assembly of module 800 is included in memory, eg, assembly of module 232 in memory 212 . In some such embodiments, the assembly of the modules is included as part of a routine in memory. In still other embodiments, the various modules in the assembly of modules 800 are implemented as a combination of hardware and software, eg, in combination with another circuit external to the processor, to provide input to the processor and then to control the to perform part of the function of the module. Although shown in various embodiments as a single processor (eg, a computer), it should be appreciated that a processor may be implemented as one or more processors (eg, a computer).

When implemented in software, a module includes code that, when executed by a processor, configures the processor to implement the function corresponding to the module. In embodiments where the assembly of module 800 is stored in memory, the memory is a computer program product comprising a computer-readable medium including code, eg, separate code for each module, for enabling at least one A computer (eg, a processor) implements the functions corresponding to the modules.

Either fully hardware based or fully software based modules can be used. It should be appreciated, however, that these functions may be implemented using any combination of software and hardware (eg, circuit-implemented modules). It should be appreciated that the modules shown in FIG. 5 control and/or configure a device or element (such as a processor) therein to perform corresponding steps shown in a method (eg, steps of the method of flowchart 400 of FIG. 4 ) ) function.

The assembly of the module 800 includes a monitoring command generation module 806, a monitoring command communication module 807, a failure notification command generation module 826, a failure notification command communication module 827, a first packet capture command generation module 840, a first packet capture command communication module 841, a first packet capture command communication module 841, and a first packet capture command communication module 841. A two-packet capture instruction generation module 844 , a second packet capture instruction communication module 845 , a failure notification message reception module 847 , a captured packet reception module 849 , an analysis module 851 , and a corrective action module 853 .

The monitoring command generation module 806 is configured to generate monitoring commands to monitor the configured access points to detect communication failures corresponding to communication devices using the access points. The monitoring command generation module 806 is configured to generate at least a first monitoring command to configure a first access point to monitor to detect communication failures corresponding to communication devices using the first access point. In some embodiments, the generated monitor command commands the access point to monitor for one or more or all of the following: association failures, authorization failures, DHCP failures, and DNS lookup failures. The monitoring command generation module 806 is configured to generate at least a first monitoring command to configure the Nth access point to monitor to detect communication failures corresponding to communication devices using the Nth access point.

The monitoring command communication module 807 is configured to transmit the generated monitoring command to the access point. For example, the monitoring command communication module 807 is configured to transmit at least a first monitoring command to configure the first access point to monitor to detect a communication failure corresponding to a communication device using the first access point.

In some embodiments, the first monitoring command is a command instructing the access point to monitor to detect a specified communication failure corresponding to any communication device using the access point. In some embodiments, the first monitoring command is a command instructing the access point to monitor to detect a specified communication failure corresponding to a specified communication device using the access point. In some embodiments, the first monitor command is a command instructing the access point to monitor packets corresponding to the particular portion of the communication operation.

The failure notification command generation module 826 is configured to generate a notification command to configure the access point to notify the network monitoring mode of the detected failure. For example, the failure notification command generation module 826 is configured to generate at least a first notification command to configure the first access point to notify the network monitoring node of the detected failure. The failure notification command communication module 827 is configured to transmit the generated notification command to configure the access point to notify the network monitoring mode of the detected failure. For example, the failure notification command communication module 827 is configured to transmit at least a first notification command to configure the first access point to notify the network monitoring mode of the detected failure.

The first packet capture instruction generation module 840 is configured to generate packet capture instructions for the access point to configure the access point to capture and buffer packets corresponding to communication devices using the access point. For example, the first packet acquisition instruction generation module 840 is configured to generate instructions for a first access point to configure the first access point to acquire and buffer communication with devices using the first access point corresponding grouping.

The first packet capture instruction communication module 841 is configured to transmit the generated packet capture instruction to the access point. For example, the first packet capture instruction communication module 841 is configured to transmit the generated packet capture instruction to the first access point to configure the first access point to capture and buffer communications with the first access point The group corresponding to the device. In some embodiments, different access points may, and sometimes are, sent different packet capture instructions. In various embodiments, the same access point may, and sometimes, be sent different packet capture instructions at different times, eg, dynamically change packets in response to changing events or conditions observed by the network monitoring mode Capture instruction.

The second packet capture instruction generation module 844 is configured to generate packet capture instructions for a particular communication device, the generated packet capture instructions to be sent to a plurality of access points. For example, the second packet capture instruction generation module 844 is configured to generate a packet capture instruction for the second communication device, the generated packet capture instruction for the second communication device to be sent to the first set of access points, The first set of access points includes a plurality of access points. In some embodiments, the packet capture instructions include instructions for capturing packets corresponding to the second communication device on any interface through which the second communication device communicates with the access point. In some embodiments, the packet capture instructions include instructions for forwarding captured packets corresponding to the second communication device even if no communication failure corresponding to the second communication device is detected. In some embodiments, the packet capture instructions include instructions for capturing and forwarding captured packets corresponding to the indicated portion of the communication activity of the second communication device. In some embodiments, the packet capture instructions include instructions to forward captured packets corresponding to the second communication device that were captured after the second communication device has achieved successful internet connectivity, but in some embodiments not on before that point.

As another example, the second packet capture instruction generation module 844 is configured to generate a packet capture instruction for the Xth communication device, the generated packet capture instruction for the Xth communication device being sent to the second group access point, the second group of access points includes a plurality of access points. The second set of access points may be the same as or different from the first set of access points.

The second packet capture instruction communication module 845 is configured to communicate instructions for packet capture generated for a particular communication device to the plurality of access points. For example, the second packet capture instruction communication module 845 is configured to transmit the generated packet capture instruction for the second communication device to a first set of access points, the first set of access points including a plurality of access points. As another example, the second packet capture instruction communication module 845 is configured to transmit the generated packet capture instruction for the Xth communication device to a second set of access points, the second set of access points including a plurality of access points entry point.

The failure notification message receiving module 845 is configured to receive an event failure notification message from an access point (eg, a first access point) that has detected a communication with a communication device (eg, a first access point) using the access point communication device) corresponding failure, the event failure notification message includes information indicating the detected failure type.

The buffered packet receiving module 849 is configured to receive the forwarded first communication device corresponding to a communication device (eg, a detected failure (eg, a detected failure reported in a corresponding received failure notification message)) captured packets. The forwarded captured packets have been sent by the access point that detected the failure. The buffered packet receiving module 849 is also configured to receive forwarded capture packets corresponding to the identified communication device (eg, the second communication device) that has transmitted the packet, regardless of whether a failure corresponding to the identified communication device is detected, For example, based on previous instructions from the network monitoring node to identify the communication device and request to send packets from the device if detected.

Analysis module 851 (eg, captured packet evaluation module) processes received event failure notification messages and corresponding forwarded captured packets, as well as received forwarded captured packets corresponding to identified communication devices, to: detect failures , identify the type or classification of detected failures, detect anomalies, detect potential failures, determine the source of the failure (e.g., a specific node, a specific link, a specific device, a specific interface on a specific device, a specific WLAN, device misconfiguration, bad configuration, poor air link channel quality and failure frequency), make replacement decisions, and/or make redundancy management decisions. The analysis module 851 includes a DHCP server misconfiguration detection module 855 , a timeout-driven authentication failure detection module 857 , a configuration problem detection module 859 , a device failure detection module 861 , a WLAN failure detection module 863 , and an abnormality detection module 865 . The DHCP server misconfiguration detection module 855 is configured to detect (eg, dynamically detect) DHCP server misconfiguration errors. The timeout-driven authentication failure detection module 857 is configured to detect (eg, dynamically detect) a large number (eg, an amount exceeding a predetermined threshold) of authentication failures driven by timeouts during a handshake, eg, due to poor coverage, failures, and retries . Configuration problem detection module 859 is configured to detect (eg, dynamically detect) authentication failures or DHCP failures related to WLAN and/or SSID configuration, eg, bad WLAN or bad server IP. Device failure detection module 861 is configured to detect (eg, dynamically detect) that failures are associated with a single device while other devices are functioning normally. WLAN failure detection module 863 is configured to detect (eg, dynamically detect) that failures are associated with a single WLAN, while other WLANs are functioning normally. Anomaly detection module 865 is configured to detect anomalies based on analysis of stored packet captures over long periods of time (eg, hours or days). In some embodiments, the anomaly detection module 865 detects subtle and/or intermittent failures based on long-term analysis of captured packets, and in some embodiments, detects one or more properties corresponding to a device, node, network, or interface Statistical changes to metrics, e.g. downgrades, trends, etc.

Corrective action module 853 is configured to take corrective action in response to the determination of analysis module 851, eg, generate and send notifications, commands and/or control messages to implement corrective action and improve performance in the communication network. Corrective action module 853 includes DHCP reconfiguration module 867 , air link channel quality control module 869 , network administrator notification module 871 , device reboot module 873 , WLAN reboot module 875 , detected exception notification module 877 . DHCP reconfiguration module 867 is configured to generate and send commands and/or notifications to reconfigure the identified DHCP servers in response to (eg, by module 855) detecting a particular DHCP server misconfiguration. The air link channel quality control module 869 is configured to respond (e.g., by module 857) to detecting a large number (e.g., exceeding a predetermined threshold) of authentication failures driven by timeouts during the handshake (e.g., due to poor coverage, failures, and/or retry) to generate and send control messages to improve air link channel quality. In some embodiments, the air link quality control module 869 uses radio management software to modify, for example, the transmit power of access point and/or user equipment devices, and/or to modify air link channels to improve air link quality. The network administrator notification module 871 is configured to be generated in response to (eg, by module 859 ) detecting an authentication failure or a DHCP failure related to the WLAN and/or SSID configuration (eg, the presence of a suspected bad WLAN or a suspected bad server IP) Anomaly detection notifications are sent to network administrators. Device restart module 873 is configured to generate and send commands to restart the device associated with the failure in response to (eg, by module 4013 ) detecting that the failure is associated with a single device while other devices are functioning normally. WLAN restart module 875 is configured to generate and send commands to restart a set of access points corresponding to the WLAN associated with the failure in response to detecting (eg, by module 863 ) that the failure is associated with a single WLAN while the other WLANs are functioning normally. Access Point. Detected anomaly notification module 877 is configured to generate and send detected anomalies to a network administrator (eg, by module 865 ) in response to anomalies detected based on analysis of long-term (eg, hours or days) stored packet captures. exception notification. In some embodiments, the corrective action module 853 generates and sends commands to shut down and/or replace a particular suspect device (eg, a suspect faulty access point). In some embodiments, corrective action module 853 generates and sends a command to switch to a backup unit, eg, a node may include a primary access point and a secondary (eg, backup) access point. In some embodiments, the corrective action module 853 generates and sends commands to control the access point to cease operation of a particular one of a plurality of alternate interfaces in the access point, eg, shutting down the WiFi interface. In some embodiments, the corrective action module 853 generates and sends a command indicating to replace a portion of the n-node, eg, replace a portion of an access point corresponding to a particular interface in question, eg, replace an interface including WiFi, Bluetooth, and BLE interfaces Bluetooth circuit card in the in point.

FIG. 6 , which includes the combination of FIGS. 6A and 6B , is a diagram 900 of an exemplary assembly of a module 900 including a combination of part A 901 and part B 903 , according to an exemplary embodiment. In some embodiments, assembly of module 900 is included in an access point (eg, a wireless access point, such as access point 300 of FIG. 3 , base station 1132 of FIG. 1 , or base station M of FIG. 1 ) implemented in accordance with an exemplary embodiment 132' or the access point 126 of FIG. 1).

The modules in the assembly of module 900 may, in some embodiments, be implemented entirely in hardware within a processor (eg, processor 306 ), eg, as separate circuits. The modules in the assembly of modules 900 may, and in some embodiments, be implemented entirely in hardware external to the processor within the assembly of modules (eg, the assembly of modules 308 ), eg, as separate circuits corresponding to different modules . In other embodiments, some modules are implemented as circuits within a processor, for example, while other modules are implemented as circuits and assemblies of modules, eg, within modules external to the processor and coupled to the processor. It should be appreciated that the level of integration of modules within the processor and/or with some modules external to the processor may be one of design choices.

Alternatively, rather than being implemented as circuits, all or some of the modules may be implemented in software and stored in the memory of the device, where the modules control the operation of the device to implement the functions corresponding to the modules when the modules are executed by the processor. In some such embodiments, assembly of module 900 is included in memory, eg, assembly of module 318 in memory 312 . In some such embodiments, the assembly of the modules is included as part of a routine in memory. In still other embodiments, the various modules in the assembly of modules 900 are implemented as a combination of hardware and software, eg, in combination with another circuit external to the processor, to provide input to the processor and then to control the to perform part of the function of the module. Although shown in various embodiments as a single processor (eg, a computer), it should be appreciated that a processor may be implemented as one or more processors (eg, a computer).

When implemented in software, a module includes code that, when executed by a processor, configures the processor to implement the function corresponding to the module. In embodiments where the assembly of modules is stored in memory, the memory is a computer program product comprising a computer-readable medium including code, eg, separate code for each module, for causing at least one computer (eg, a processor) implements the functions corresponding to the modules.

Either fully hardware based or fully software based modules can be used. It should be appreciated, however, that these functions may be implemented using any combination of software and hardware (eg, circuit-implemented modules). It should be appreciated that the modules shown in FIG. 6 control and/or configure devices or elements (such as processors) therein to perform corresponding steps shown in the method (eg, steps of the method of flowchart 400 of FIG. 4 ) ) function.

The assembly of module 900 includes monitoring command receiving module 912, fault notification command receiving module 932, first packet capture command receiving module 953, second packet capture command receiving module 964, packet forwarding configuration module 970 based on the identified communication device, Detected failure packet forwarding configuration module 972, packet capture module 976, captured packet buffer module 978, communication failure monitoring module 980, identified device packet detection module 982, identified device packet forwarding module 9981, event failure notification A generation module 986 , an event failure notification communication module 988 , a detected failure packet forwarding module 990 , and a packet buffer stop determination module 982 .

The monitoring command receiving module 912 is configured to operate the access point to receive configuration information from the network monitoring node, the configuration information indicating the communication failures to be monitored by the access point for detection, eg, on a per access point interface basis. The monitoring command receiving module 912 includes: an associated failure monitoring command receiving module 913 configured to receive information indicating that the first access point will monitor the associated failure; an authorized failure monitoring command receiving module 915 configured to receive an indication that the access point will monitor information for authorization failures; a DHCP failure monitoring command receiving module 917 configured to receive information indicating that the access point will monitor for authorization failures; and a DSN lookup failure monitoring command receiving module 919 configured to receive information indicating that the access point is monitoring DNS lookups Fault.

The failure notification command receiving module 932 is configured to operate the access point to receive from the network monitoring node one or more notification commands including at least a first notification command that configures the access point to notify the network monitoring node Detected failure command.

The first packet capture instruction receiving module 953 is configured to operate the access point to receive capture instruction information from the network monitoring node. The first packet capture command receiving module 953 includes a network connectivity attempt packet capture command receiving module 954, a packet number capture command receiving module 956, an enable/disable packet capture command receiving module 958, and an identified communication device packet capture command receiving module 960 . The network connectivity attempt packet capture instruction receiving module 954 is configured to operate the first access point to receive information from the network monitoring node indicating the number of broadcast and multicast packets corresponding to the communication device to capture during the communication device attempt to Implement a network connection. Packet number capture instruction receiving module 956 is configured to operate the access point to receive information from the network monitoring device indicating the total number of packets and the indicator and the length of the packets captured and buffered for each communication device using the access point. The enable/disable packet capture command receiving module 958 is configured to operate the access point to receive commands from the network monitoring node to enable or disable packet capture at the access point. The identified communication device packet capture instruction receiving module 960 is configured to operate the access point to receive instructions to capture packets for the identified communication device on a plurality of different interfaces.

The second packet capture instruction receiving module 964 is configured to operate the access point to receive packet capture instructions for a particular communication device (eg, the second communication device) from the network monitoring node. In some of these embodiments, the packet capture instructions received for a particular communication device are directed to multiple access points. The second packet capture instruction receiving module 964 includes a target device packet capturing instruction receiving module 965 . Target device packet capture instruction receiving module 965 is configured to receive a packet capture instruction corresponding to a particular communication device (eg, a second communication device) targeted by the network monitoring device, eg, in response to the second communication device Suspected Intermittent Failure Condition.

The identified communication device based packet forwarding configuration module 970 is configured to configure the access point to forward captured packets corresponding to one or more identified communication devices (eg, a second communication device) to the network monitoring node, Regardless of whether a communication failure corresponding to the identified communication device is detected or not. Detected failure based packet forwarding configuration module 972 is configured to configure the access point to forward captured packets corresponding to a communication device that detected a communication failure, but not to a communication device that has not detected a communication failure and not regardless of failure status Captured packets corresponding to the communication devices of the identified communication devices for which the packets are to be forwarded. Accordingly, module 972 configures the access point to selectively forward captured packets based on failure detection, while module 970 configures the access point to selectively forward captured packets based on target device identification, eg, using a previously selected target communication The device's network monitoring node. In some embodiments, the network monitoring mode imposes further conditions on selective packet forwarding, eg, during certain phases of operation of the communication device of interest to the network monitoring node.

The packet capture module 976 is configured to operate the access point to capture packets corresponding to communication devices using the access point. Captured packet buffering module 978 is configured to store captured packets in a buffer, eg, in memory of the access point.

Communication failure monitoring module 980 is configured to operate an access point to monitor to detect communication failures corresponding to communication devices using the access point. The communication failure monitoring module 980 includes: an association failure detection module 981, which is configured to monitor and detect association failures; an authorization failure detection module 983, which is configured to monitor and detect authorization failures; and a DHCP failure detection module 985, which is configured to monitor and detect DHCP failures; and a DNS lookup failure detection module 987 configured to monitor and detect DNS lookup failures. In some embodiments, which of modules 981, 983, 985, and 987 are used is based on monitoring command information previously received from a network monitoring node, eg, for configuring an access point.

The identified device packet detection module is configured to operate the access point to monitor to detect communication with one or more identified communication devices (eg, a second communication device) for which packets are to be forwarded regardless of failure detection corresponding grouping. The identified device packet forwarding module 9981 is configured to operate the access point to forward captured packets corresponding to the identified communication device to the network monitoring node regardless of whether a failure corresponding to the identified communication device is detected.

The event failure notification generation module 986 is configured to generate an event failure notification at the access point indicating the type of failure detected, the generation being responsive to detection of a first communication with a communication device using the access point (eg, a first communication device) corresponding to the communication failure. In various embodiments, the format of the event failure notification is based on information previously received in a notification command from the network monitoring node. In some embodiments, the type of failure is one of: association failure, authorization failure, DHCP failure, and DNS lookup failure. In some embodiments, the event notification information includes a failure log corresponding to the event, the failure log including information known to the access node that is useful for troubleshooting the failure. The event failure notification communication module 988 is configured to send the generated event failure notification from the first access point to the network monitoring node. The detected failure packet forwarding module 990 is configured to forward capture packets corresponding to the device (eg, the first communication device) corresponding to the detected communication failure to the network monitoring mode. In some embodiments, the detected failure packet forwarding module 990 forwards the captured packets along with the event failure notification or is included in the event failure notification.

The packet buffering stop determination module 992 determines whether a packet buffering stop criterion for a potential failure of the communication device has been reached, eg, Internet access has been achieved, and controls operation in accordance with this determination.

Stored packet deletion module 994 is configured to delete stored captured packets corresponding to the communication device in response to reaching the packet buffering stop criterion, which packets were stored prior to meeting the packet buffering stop criterion. The stored packet deletion module 994 includes a communication stored packet deletion module 996 based on a successful DNS lookup. The communication storage packet deletion based on successful DNS lookup module 996 is configured to delete storage packets corresponding to the communication device that were stored prior to the SNS lookup when the communication device successfully completed the SNS lookup.

The assembly of module 900 also includes a corrective action message receiving module 9991, a radio management module 9993, a backup control module, an interface deactivation module 9997, and a restart module. Corrective action receiving module 9991 is configured to receive corrective action messages from network monitoring nodes, eg, corrective action messages notifying access points of detected problems and/or commanding or controlling access points to effect corrective actions, eg (i) shutting down the service access point, (ii) restarting the access point, (iii) shutting down (e.g., deactivating) a particular interface, eg, one of multiple alternative wireless interfaces supported by the access point, (iv) restarting a particular interface interface, (v) denying service to a particular user equipment device, (vi) switching to a backup unit, eg, a redundant access point, backup interface, backup power supply, backup receiver, backup transmitter, or backup included in the device Antennas, (vii) perform commanded or recommended radio management operations to improve air link quality. The radio management module 9993 is configured to implement radio management commands or instructions, such as changing the transmit power level of an access point in response to a command received from a network monitoring node or using the access point to control a UE device to change its transmit power to improve the air Link channel quality. The backup control module 9995 is configured to switch to a backup device within the access point, such as a redundant circuit or interface, in response to a command from the network monitoring node. The interface deactivation module 9997 is configured to deactivate (eg, shut down) a particular wireless interface within the access point, eg, shut down the BLE interface, in response to a command from the network monitoring node. The reboot module 9999 is configured to reboot the access point or a portion of the access point (eg, a particular identified wireless interface) in response to a command received from the network monitoring node.

7 is an illustration of an exemplary communication device 700 (eg, user equipment such as a wireless terminal) in accordance with an exemplary embodiment. Exemplary communication device 700 is, for example, UE device 1 134, UE N 134, UE H1 128, or UE HZ 130 of system 100 of FIG. Communication device 700 includes wired interface 702, wireless interface 704, processor 706 (eg, CPU), display 708, input device 710 (eg, touch screen, keypad, switches, etc.), memory 712, and Assembly of modules 716 (eg, assembly of hardware modules, such as circuits), the various elements may exchange data and information over bus 718 . Memory 712 includes routines 713 including assembly of modules 715 (eg, assembly of software modules), and data/information 715 . Wired interface 702 (eg, an Ethernet interface) includes receiver 720 and transmitter 722 . The wireless interface 704 includes a cellular interface 724, a WiFi interface 726 (eg, an 802.11 interface, a Bluetooth interface 728, and a BLE interface 730). The cellular interface includes a cellular receiver 732 coupled to a receive antenna 750 via which the communication device receives cellular signals. The cellular interface 724 includes a cellular transmitter 734 coupled to a transmit antenna 752 via which the communication device 700 transmits cellular signals.

The WIFI interface 726 includes a WIFI receiver 736 (eg, an 802.11 receiver) coupled to a receive antenna 750 via which the communication device receives WIFI signals. The WIFI interface 726 includes a WIFI transmitter 738 coupled to a transmit antenna 752 via which the communication device 700 transmits WIFI signals.

The Bluetooth interface 728 includes a Bluetooth receiver 740 coupled to a receive antenna 750 via which the communication device receives Bluetooth signals. The Bluetooth interface 728 includes a Bluetooth transmitter 742 coupled to a transmit antenna 752 via which the communication device 700 transmits Bluetooth signals. The BLE interface 730 includes a BLE receiver 744 coupled to a receive antenna 750 via which the communication device receives BLE signals. The BLE interface 730 includes a BLE transmitter 746 coupled to a transmit antenna 752 via which the communication device 700 transmits BLE signals. In some embodiments, the same antenna is used to receive and transmit signals. In some embodiments, different antennas corresponding to at least some of the different wireless interfaces are used.

List of Exemplary Numbering Method Embodiments

Method Embodiment 1. A method for capturing and providing communication-related information, the method comprising:

operating a first access point to capture packets corresponding to communication devices using the first access point;

operating the first access point to monitor to detect communication failures corresponding to communication devices using the access point; and

in response to detecting a communication failure corresponding to the first communication device, generating an event failure notification at the first access point indicating the type of failure detected; and

An event failure notification is sent from the first access point to the network monitoring node.

Method embodiment 2. The method according to numbering method embodiment 1, wherein the first access point is a wireless access point.

Method Embodiment 3. The method of claim 2, wherein the communication device is a wireless device.

Method embodiment 4, according to the method of numbering method embodiment 1, further comprising:

In response to detecting the communication failure corresponding to the first communication device, the step of forwarding captured packets corresponding to the first communication device corresponding to the detected communication failure to the network monitoring node is also performed.

Method embodiment 5, according to the method of numbering method embodiment 1, also comprises:

After the communication device successfully completes the DNS lookup, the stored packets corresponding to the communication device that were captured and stored prior to the DNS lookup are deleted.

Method embodiment 6. The method according to numbering method embodiment 5, wherein the communication device is a wireless terminal.

Method embodiment 7. The method of numbering method embodiment 1, wherein the first access point is configured to forward the captured packets corresponding to the communication device that detected the communication failure, without forwarding and using the first access point. Captured packets corresponding to communication devices of the in-point where no communication failure has been detected.

Method embodiment 8, according to the method of numbering method embodiment 1, further comprising:

The first access point is operated to receive configuration information from the network monitoring node indicating a communication failure to be monitored by the first access point for detection.

Method embodiment 9, according to the method of numbering method embodiment 8,

wherein the first access point includes a plurality of different interfaces; and

wherein the information from the network monitoring node indicating the communication failure to be monitored by the first access point is provided on a per access point interface basis.

Method embodiment 10. The method according to numbering method embodiment 8, wherein the plurality of different interfaces includes two different wireless interfaces.

Method Embodiment 11. The method according to Numbering Method Embodiment 9, wherein the information indicating the communication failures to be monitored by the first access point includes one or more of the following: association failures, authentication failures, authorization failures, DHCP failure and DNS lookup failure.

Method embodiment 12, the method according to numbering method embodiment 11, further comprising:

The first access point is operative to receive information from a network monitoring node indicating a number of broadcast and multicast packets corresponding to the communication device to be captured during an attempt by the communication device to achieve a network connection.

Method embodiment 13, according to the method of numbering method embodiment 12, further comprising:

The first access point is operated to receive information from the network monitoring node indicating the total number of packets and an indicator of the length of the packets captured and buffered for each communication device using the first access point.

Method Embodiment 14, according to the method of Numbering Method Embodiment 13, further comprising:

The first access point is operated to receive a command from a network monitoring node to enable or disable packet capture at the first access point.

Method Embodiment 15, according to the method of Numbering Method Embodiment 13, further comprising:

operating the first access point to receive instructions to capture packets for the identified communication device on a plurality of different interfaces; and

The first access point is operated to forward captured packets corresponding to the identified communication device to a network monitoring mode regardless of whether a communication failure corresponding to the identified communication device is detected.

Method embodiment 16. The method of numbering method embodiment 15, wherein the identified communication device is a multi-mode communication device, and wherein a communication failure on the first interface causes the identified communication device to switch to the second interface.

Method embodiment 17. The method of numbering method embodiment 16, wherein the first and second interfaces are different types of wireless interfaces.

Method Embodiment 18, according to the method of Numbering Method Embodiment 1, further comprising:

operating a network node to communicate packet capture instructions to the first access point to configure the first access point to capture and buffer packets corresponding to communication devices using the first access point; and

operating a network monitoring node to transmit at least a first monitoring command configuring a first access point, the first monitoring command configuring the first access point to monitor to detect a communication device corresponding to a communication device using the first access point Communication failure.

Method embodiment 19, the method according to numbering method embodiment 18, further comprising:

The network monitoring node is operated to transmit at least a first notification command that configures the first access point to notify the network monitoring mode of the detected failure.

Method embodiment 20. The method of numbering method embodiment 1, wherein the first monitoring command is a command instructing the first access point to monitor to detect specified communication failures corresponding to any communication device using the first access point.

Method embodiment 21. The method of numbering method embodiment 1, wherein the first monitoring command is a command instructing the first access point to monitor to detect a specified communication failure corresponding to a specific communication device that can use the first access point.

Method embodiment 22. The method according to numbering method embodiment 1, wherein the first monitoring command is a command ( This allows for packet capture and reporting for specific wireless terminals and specific parts of a communication session, even when no errors are detected, to facilitate detection of issues or errors that do not explicitly indicate a problem or error itself when considered but may over time indicate a communication session Problems with errors in specific parts, e.g. due to errors or problems with the interface/communication associated with the interface, etc., such as the timeout setting being shorter than appropriate, the device can repeatedly disconnect on the interface and connect as soon as the connection is successfully established to another interface).

Method embodiment 23, according to the method of numbering method embodiment 15, further comprising:

The network monitoring node is operated to communicate packet capture instructions for the second communication device to the plurality of access points.

Method embodiment 24. The method of numbered method embodiment 23, wherein the packet capture instructions comprise instructions to capture packets corresponding to the second communication device on any interface the second communication device communicates with the access point.

Method embodiment 25. The method of numbering method embodiment 24, wherein the packet capture instruction comprises forwarding the captured packet corresponding to the second communication device even if a communication failure corresponding to the second communication device is not detected instruction.

Method embodiment 26. The method of numbering method embodiment 24, wherein the packet capture instructions comprise instructions for capturing and forwarding packets corresponding to the indicated portion of the communication activity of the second communication device.

Method embodiment 27. The method of numbering method embodiment 24, wherein the packet capture instruction includes an instruction to forward a captured packet corresponding to the second communication device after the second communication device has achieved a successful Internet connection (but not before that point in some embodiments).

List of Exemplary Numbering System Embodiments

System embodiment 1, a communication system, comprising:

The first access point, including the first processor, is configured to:

operating a first access point to capture packets corresponding to communication devices using the first access point;

operating the first access point to monitor to detect communication failures corresponding to communication devices using the access point; and

in response to detecting a communication failure corresponding to the first communication device, generating an event failure notification at the first access point indicating the type of failure detected; and

An event failure notification is sent from the first access point to the network monitoring node.

System embodiment 2. The communication system according to numbering system embodiment 1, wherein the first access point is a wireless access point.

System Embodiment 3. The communication system according to numbering system embodiment 2, wherein the communication device is a wireless device.

System Embodiment 4. The communication system according to numbering system embodiment 1, wherein the first processor is further configured to:

Executing step: in response to detecting the communication failure corresponding to the first communication device, forwarding the captured packet corresponding to the first communication device corresponding to the detected communication failure to the network monitoring node, and further executing Step: forwarding the captured packets corresponding to the first communication device corresponding to the detected communication failure to the network monitoring node.

System Embodiment 5. The communication system according to numbering system embodiment 1, wherein the first processor is further configured to:

After the communication device successfully completes the DNS lookup, the stored packets corresponding to the communication device that were captured and stored prior to the DNS lookup are deleted.

System Embodiment 6. The communication system according to numbering system embodiment 6, wherein the communication device is a wireless terminal.

System Embodiment 7. The communication system of numbering system embodiment 1, wherein the first processor is configured to forward captured packets corresponding to the communication device that detected the communication failure, without forwarding the packets associated with using the first interface. Captured packets corresponding to communication devices of the in-point where no communication failure has been detected.

System Embodiment 8. The communication system according to numbering system embodiment 1, wherein the first processor is further configured to:

The first access point is operated to receive configuration information from the network monitoring node indicating communication failures that the first access point is to monitor for detection.

System embodiment 9, according to the communication system of numbering system embodiment 8,

wherein the first access point includes a plurality of different interfaces; and

wherein the information from the network monitoring node indicating the communication failure to be monitored by the first access point is provided on a per access point interface basis.

System Embodiment 10. The communication system of numbering system embodiment 8, wherein the plurality of different interfaces includes two different wireless interfaces.

System Embodiment 11. The communication system according to numbering system embodiment 9, wherein the information indicative of communication failures to be monitored by the first access point includes one or more of the following: association failures, authentication failures, authorization failures , DHCP failure, and DNS lookup failure.

System Embodiment 12. The communication system according to numbering system embodiment 11, wherein the first processor is further configured to:

The first access point is operative to receive information from a network monitoring node indicating a number of broadcast and multicast packets corresponding to the communication device to be captured during an attempt by the communication device to achieve a network connection.

System Embodiment 13. The communication system according to numbering system embodiment 12, wherein the first processor is further configured to:

The first access point is operated to receive information from the network monitoring node indicating the total number of packets and an indicator of the length of the packets captured and buffered for each communication device using the first access point.

System Embodiment 14. The communication system according to numbering system embodiment 13, wherein the first processor is further configured to:

The first access point is operated to receive a command from a network monitoring node to enable or disable packet capture at the first access point.

System Embodiment 15. The communication system according to numbering system embodiment 13, wherein the first processor is further configured to:

operating the first access point to receive instructions to capture packets for the identified communication device on a plurality of different interfaces; and

The first access point is operated to forward captured packets corresponding to the identified communication device to a network monitoring mode regardless of whether a communication failure corresponding to the identified communication device is detected.

System Embodiment 16. The communication system of numbering system embodiment 15, wherein the identified communication device is a multi-mode communication device, and wherein a communication failure on the first interface causes the identified communication device to switch to the second interface.

System Embodiment 17. The communication system of numbering system Embodiment 16, wherein the first and second interfaces are different types of wireless interfaces.

System embodiment 18, the communication system according to numbering system embodiment 1, further comprising:

a network node including a second processor configured to:

operating a network node to communicate packet capture instructions to the first access point to configure the first access point to capture and buffer packets corresponding to communication devices using the first access point; and

operating a network monitoring node to transmit at least a first monitoring command configuring a first access point, the first monitoring command configuring the first access point to monitor to detect a communication device corresponding to a communication device using the first access point Communication failure.

System Embodiment 19. The communication system of numbering system embodiment 18, wherein the second processor is further configured to: operate the network monitoring node to transmit at least a first notify command that sends the first access point Configured to notify network monitoring mode of detected failures.

System Embodiment 20. The communication system of numbering system embodiment 1, wherein the first monitoring command is a command instructing the first access point to monitor to detect specified communication failures corresponding to any communication device using the first access point.

System Embodiment 21. The communication system of numbering system embodiment 1, wherein the first monitoring command is a command instructing the first access point to monitor to detect specified communication failures corresponding to specific communication devices that may use the first access point .

System Embodiment 22. The communication system of numbering system embodiment 1, wherein the first monitoring command is a command instructing the first access point to monitor packets corresponding to a specific part of the communication operation (eg, a post-Internet connection) and a specific communication device (This allows for packet capture and reporting for specific wireless terminals and specific parts of a communication session, even when no errors are detected, to facilitate detection when considered not explicitly indicative of a problem or error per se but may over time indicate a communication session Problems with errors in specific parts of, for example, due to errors or problems with the interface/communication associated with the interface, etc., such as the timeout setting being shorter than appropriate, the device can repeatedly disconnect on the interface and after a successful connection is established immediately connect to another interface).

System Embodiment 23. The communication system according to numbering system embodiment 15, wherein the second processor is further configured to:

The network monitoring node is operated to communicate packet capture instructions for the second communication device to the plurality of access points.

System Embodiment 24. The communication system of numbering system embodiment 23, wherein the packet capture instructions comprise instructions to capture packets corresponding to the second communication device on any interface through which the second communication device communicates with the access point.

System Embodiment 25. The communication system of numbering system embodiment 24, wherein the packet capture instruction includes forwarding the captured data corresponding to the second communication device even if a communication failure corresponding to the second communication device is not detected. grouped instructions.

System Embodiment 26. The communication system of numbering system embodiment 24, wherein the packet capture instructions comprise instructions for capturing and forwarding packets corresponding to the indicated portion of the communication activity of the second communication device.

System Embodiment 27. The communication system of numbering system embodiment 24, wherein the packet capture instruction includes an instruction to forward a captured packet corresponding to a second communication device where the second communication device has achieved a successful Internet connection After (but in some embodiments not before that point) is captured.

In some embodiments, a system administrator may turn off the always-on automatic packet capture and upload detected failure feature at one or more access points, and then The device turns it on after it detects or reports an anomaly, such as a failure of a protocol.

In some embodiments, network management software (eg, backend software) running on a management server that performs analysis of one or more client events detects a cluster of DHCP failures on a particular subnet of the network. The server then enables dynamic packet capture on the access points of the given subnet where the DHCP failure is detected, and collects and analyzes the packets. After packet collection and/or analysis, the server signals the access point to turn off automatic capture of packets.

In other cases, the system administrator may have a configured set of dynamic packet capture options, eg, packets to be captured and forwarded in the event of one or more detected failure conditions at the access point. In such an embodiment, software on a management server in the network can detect that a group of client devices of a specific OS type have application-specific issues that are not covered by the standard trap configuration (eg trap on auth failure, trap on DHCP failure, etc.) and packet capture and reporting conditions can be modified to facilitate collection of packets that may be useful in further analysis to identify problems. The management server in such an embodiment may send a list of client mac addresses (MAC addresses of client devices to monitor) across sites or devices in the network (eg, access points), and instruct the access points to capture Grouping (e.g., a specific number of packets) of a given application executed by a client device with one of the listed mac addresses, and thereby dynamically identifying and controlling the capture of packet data for targeting with MAC addresses in the distributed list or other device identifiers to further analyze and find the root cause of the problem.

Management software running on a network server or other device can also identify that a given known issue is associated with clients connecting on a specific SSID/WLAN and control packet capture and reporting for devices using a specific SSID or WAN. The server can, and sometimes does, dynamically send configuration control instructions and/or information to the access point to turn on capture and reporting for a given SSID and/or WLAN.

The techniques of the various embodiments may be implemented using software, hardware, and/or a combination of software and hardware. Various embodiments are directed to apparatuses, eg, management entities (eg, network monitoring nodes, routers, gateways, access points, DHCP servers, DNS servers, AAA servers), user equipment devices (eg, mobile wireless terminals such as mobile wireless terminals). node, base station), communication network, communication system. Various embodiments are also directed to methods, eg, methods of controlling and/or operating one or more communication devices, such as network management nodes, access points, wireless terminals (UEs), base stations, control nodes, DHCP nodes, DNS Server, AAA node, MME, network and/or communication system. Various embodiments are also directed to non-transitory machines (eg, computers), readable media (eg, ROM, RAM, CDs, hard disks, etc.) including machine-readable instructions for controlling the machine to implement one or more steps of a method ).

It is understood that the specific order or hierarchy of steps in the disclosed processes is an example of a sample approach. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged while remaining within the scope of the present disclosure. The accompanying method claims present elements of the various steps in a sample order, and are not meant to be limited to the specific order or hierarchy presented.

In various embodiments, the devices and nodes described herein are implemented using one or more modules to perform steps corresponding to one or more methods, eg, signal generation, transmission, processing, analysis, and/or reception steps. Accordingly, in some embodiments, various features are implemented using modules. Such modules may be implemented using software, hardware, or a combination of software and hardware. In some embodiments, each module is implemented as a separate circuit, wherein the device or system includes a separate circuit for implementing the functionality corresponding to each described module. Many of the above-described methods or method steps may be implemented using machine-executable instructions (such as software) included in a machine-readable medium (eg, RAM, floppy disk, etc.) such as a memory device to control a machine (eg, , a general-purpose computer with or without additional hardware) to implement all or part of the above-described method, eg, in one or more nodes. Thus, among other things, various embodiments are directed to machine-readable media, eg, non-transitory computer-readable media, comprising means for causing a machine (eg, a processor and associated hardware) to execute (one or more each) machine-executable instructions for one or more steps of the above method. Some embodiments are directed to an apparatus comprising a processor configured to implement one, more or all steps of one or more methods of the present invention.

In some embodiments, one or more processors (eg, CPUs) of one or more devices (eg, communication devices such as network management nodes, wireless terminals (UEs), and/or access nodes) are configured To perform the steps of a method described as being performed by an apparatus. The configuration of the processor may be through the use of one or more modules (eg, software modules) to control the configuration of the processor and/or by including hardware (eg, hardware modules) in the processor to perform the described steps and/or to control the configuration of the processor to fulfill. Thus, some but not all embodiments are directed to a communication device (eg, user equipment) having a processor including a module corresponding to each step of the various described methods performed by the device in which the processor is included. In some but not all embodiments, the communication device includes a module corresponding to each step of the various described methods performed by the device including the processor therein. A module may be implemented purely in hardware (eg, as a circuit), or may be implemented using software and/or hardware or a combination of software and hardware.

Some embodiments are directed to a computer program product comprising a computer-readable medium comprising means for causing a computer or computers to implement various functions, steps, actions and/or operations (eg, one or more of the above). step) code. Depending on the embodiment, the computer program product can, and sometimes does, include different code for each step to be performed. Thus, a computer program product may, and sometimes does, include code for each individual step of a method (eg, a method of operating a communication device) such as a network management node, access point, base station, wireless terminal or node . The code may be in the form of machine (eg, computer) executable instructions stored on a computer readable medium such as RAM (Random Access Memory), ROM (Read Only Memory), or other types of storage devices. In addition to being directed to computer program products, some implementations are directed to processors configured to implement one or more of the various functions, steps, actions, and/or operations of one or more of the above-described methods. Thus, some embodiments are directed to a processor (eg, a CPU) configured to implement some or all of the steps of the methods described herein. A processor may be used, for example, in a communication device or other device as described in this application.

Although described in the context of communication systems including cellular, WiFi, Bluetooth and BLE, at least some of the methods and apparatus of the various embodiments are applicable to various communication systems including many non-OFDM and/or non-cellular systems.

Numerous additional variations to the methods and apparatus of the various embodiments described above will be apparent to those skilled in the art in view of the above description. These changes should be considered to be within that scope. The method and apparatus may be, and in various embodiments are, compatible with CDMA, Orthogonal Frequency Division Multiplexing (OFDM), WiFi, Bluetooth, BLE and/or may be used to provide wireless communication between an access node and a mobile node Various other types of communication techniques for communication links are used. In some embodiments, the access nodes are implemented as base stations that establish communication links with user equipment devices (eg, mobile nodes) using WiFi, Bluetooth, BLE, OFDM, and/or CDMA. In various embodiments, mobile nodes are implemented as notebook computers, personal data assistants (PDAs), or other portable devices that include receiver/transmitter circuits and logic and/or routines for implementing these methods.

Claims (20)

1. a kind of method for capturing and providing and communicate related information, this method comprises:

The first access point is operated to capture grouping corresponding with the communication equipment of first access point is used；

The first access point is operated to be monitored, to detect communication failure corresponding with the communication equipment of described access point is used； And

In response to detecting communication failure corresponding with the first communication equipment, the event that instruction detects is generated at the first access point Hinder the event failure notification of type；And

Event failure notification is sent from the first access point to network monitoring node.

2. the method as described in claim 1, wherein first access point is configured as forwarding and detects communication failure The grouping of the corresponding capture of communication equipment, without forward with using first access point, communication failure is not detected it is logical Believe the grouping of the corresponding capture of equipment.

3. the method as described in claim 1, further includes:

It operates the first access point and indicates that first access point will be monitored with the logical of detection to receive from the network monitoring node Believe the configuration information of failure.

4. method as claimed in claim 3,

Wherein first access point includes multiple and different interface；And

Wherein the information of instruction the first access point communication failure to be monitored from the network monitoring node is It is provided based on each access point interface.

5. method as claimed in claim 4, wherein indicating the information of the first access point communication failure to be monitored Including below when one or more of: relevant fault, certification failure, authorization failure, DHCP failure and dns lookup failure.

6. method as claimed in claim 5, further includes:

Operating the first access point will be caught during communication equipment is attempted to realize network connection with receiving instruction from network monitoring node The information of the quantity of broadcast obtaining, corresponding with communication equipment and multicast packet.

7. method as claimed in claim 6, further includes:

The first access point is operated to receive the information of instruction total number packets from network monitoring node and for using the first access point Each communication equipment capture and buffering block length indicator.

8. the method for claim 7, further includes:

The first access point is operated to receive from network monitoring node for enabling or disabling packet capture at the first access point Order.

9. the method for claim 7, further includes:

The first access point is operated to receive the instruction that the capture on multiple and different interfaces is directed to the grouping of the communication equipment identified； And

The first access point is operated so that the grouping of capture corresponding with the communication equipment identified is forwarded to network monitoring mode, and In spite of the corresponding communication failure of the communication equipment that detects with identify.

10. method as claimed in claim 9, wherein the communication equipment identified is multi-mode communication device, and wherein Communication failure on one interface makes the communication equipment identified be switched to second interface.

11. the method as described in claim 1, further includes:

Operation network monitoring node is to be transmitted to first access point for packet capture instruction, to configure first access point To capture and buffer grouping corresponding with the communication equipment of first access point is used；And

Network monitoring node is operated with the first of at least the first access point of transmitting configuration the monitoring order, the first monitoring order is by the One access point is configured to be monitored to detect communication failure corresponding with the communication equipment of first access point is used.

12. a kind of communication system, comprising:

First access point, including first processor, the first processor are configured as:

The first access point is operated to capture grouping corresponding with the communication equipment of first access point is used；

The first access point is operated to be monitored, to detect communication failure corresponding with the communication equipment of described access point is used； And

In response to detecting communication failure corresponding with the first communication equipment, the event that instruction detects is generated at the first access point Hinder the event failure notification of type；And

Event failure notification is sent from the first access point to network monitoring node.

13. communication system as claimed in claim 12, communicate wherein the first processor is configured as forwarding with detecting The grouping of the corresponding capture of the communication equipment of failure, without forward with using first access point, be not detected communicate it is former The grouping of the corresponding capture of the communication equipment of barrier.

14. communication system as claimed in claim 12, wherein the first processor is also configured to

It operates the first access point and indicates that first access point will be monitored with the logical of detection to receive from the network monitoring node Believe the configuration information of failure.

15. communication system as claimed in claim 14,

Wherein first access point includes multiple and different interface；And wherein from the instruction institute of the network monitoring node The information for stating the communication failure that the first access point to be monitored is provided based on each access point interface.

16. communication system as claimed in claim 15, wherein indicating the institute of the first access point communication failure to be monitored State information include below when one or more of: relevant fault, certification failure, authorization failure, DHCP failure and dns lookup therefore Barrier.

17. communication system as claimed in claim 16, wherein the first processor is also configured to

Operating the first access point will be caught during communication equipment is attempted to realize network connection with receiving instruction from network monitoring node The information of the quantity of broadcast obtaining, corresponding with communication equipment and multicast packet.

18. communication system as claimed in claim 17, wherein the first processor is also configured to

The first access point is operated to receive the information of instruction total number packets from network monitoring node and for using the first access point Each communication equipment capture and buffering block length indicator.

19. communication system as claimed in claim 12,

Wherein system further includes the network monitoring node；And

Wherein the network monitoring node includes second processor, which is configured as:

Operation network monitoring node is to be transmitted to first access point for packet capture instruction, to configure first access point To capture and buffer grouping corresponding with the communication equipment of first access point is used；And

Operation network monitoring node at least configures the first monitoring order of the first access point to transmit, and the first monitoring order is by the One access point is configured to be monitored to detect communication failure corresponding with the communication equipment of first access point is used.

20. a kind of non-transient computer-readable media, including machine-executable instruction, when the machine-executable instruction is by accessing Point processor execute when, make processor control access point with:

Capture grouping corresponding with the communication equipment of described access point is used；

It is monitored, to detect communication failure corresponding with the communication equipment of described access point is used；And

In response to detecting communication failure corresponding with the first communication equipment, the event event for the fault type that instruction detects is generated Barrier notice；And

Event failure notification is sent from access point to network monitoring node.